986437928021d2f9cd67d7a6e6863c14

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 1970-Jan-01 00:00:00

Plugin Output

Suspicious PEiD Signature: ASPack v2.12
Suspicious This PE is packed with RPCrypt Unusual section name found:
Unusual section name found: .rsrc\x00\x12
Unusual section name found: .mackt\x00\xcf
Unusual section name found: 04MAR05
Unusual section name found: ._fuck_
Unusual section name found: .adata
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
Possibly launches other programs:
  • ShellExecuteA
Has Internet access capabilities:
  • InternetOpenA
Info The following exploit mitigation techniques have been detected Stack Canary: disabled
SafeSEH: disabled
ASLR: disabled
DEP: disabled
Malicious VirusTotal score: 12/60 (Scanned on 2017-03-20 16:43:56) McAfee: Artemis!986437928021
AegisLab: Troj.Gen!c
Symantec: Trojan.Gen.2
TrendMicro-HouseCall: TROJ_GEN.R047C0OJ216
Endgame: malicious (moderate confidence)
Sophos: Mal/Behav-023
Comodo: UnclassifiedMalware
VIPRE: Trojan.Win32.Generic!BT
McAfee-GW-Edition: BehavesLike.Win32.Dropper.tc
Jiangmin: Trojan/Small.ehg
Antiy-AVL: Trojan/Win32.BTSGeneric
AVware: Trojan.Win32.Generic!BT

Hashes

MD5 986437928021d2f9cd67d7a6e6863c14
SHA1 bdf85f980d9ee8bd1f745732632501994f0942bf
SHA256 066779966633c6b8c1a855bec2b1da6a61abd164b4a480ad0d8650dd0d73d507
SHA3 ff0b283df59a0adc96ce710e88c257e39c312879341dfc128010374be70fcb46
SSDeep 24576:t8bHYaQ8h7OolqsfMElVqkBNvaKnpRx1N9Ns9EbHOMnUb9RaF:tCh5U6qkaKp1NcEbVnUbmF
Imports Hash ff3888cf959250f8238937c893d48f55

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 8
TimeDateStamp 1970-Jan-01 00:00:00
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 6.0
SizeOfCode 0x37f000
SizeOfInitializedData 0xaa000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x431001 (Section: ._fuck_)
BaseOfCode 0x1000
BaseOfData 0x380000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x434000
SizeOfHeaders 0x400
Checksum 0x152ed7
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics (EMPTY)
SizeofStackReserve 0x6000000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 317f055d4bb006c3c584770b53b33ddf
SHA1 26d9f9931fe4e7f9a35c7d862f5de4d7fade3064
SHA256 dd7130a74c291073cd6814ce9fcd47c93af1b45f20bc6867d34a18c268e2d0a5
SHA3 2ef214cd3e20bde55f62d9fdf25a29723d29669256c2280000ba25155ebda736
VirtualSize 0x37f000
VirtualAddress 0x1000
SizeOfRawData 0x123e00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.99969

.data

MD5 addcb7777ea88d7560b7077472fddc95
SHA1 5c6cc23922292ab348f9ca386f2bedf878f29a82
SHA256 9a821f4e2a2ee2eeae7a8598e4b78ac38ae823a9063586a3d4632daa2a4c5ac2
SHA3 e017ae2a8587d4393d335af7ee02a8bb2a829087a12b598055dc0aea53dda4ae
VirtualSize 0x6000
VirtualAddress 0x380000
SizeOfRawData 0x3a00
PointerToRawData 0x124200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.98356

MD5 ea2b888aaa17b00e395f64414fec2e81
SHA1 94bad8840276b69d7a695fc2676aafa3a55c086e
SHA256 4f706d307bceb16e01da116d9319d9230103af9d6a398cead95b27394ba762ee
SHA3 d88381b263b8ffbe11b4658bd5d5a1322a96e14b113f5795ea009e1d176030e8
VirtualSize 0x64000
VirtualAddress 0x386000
SizeOfRawData 0xd400
PointerToRawData 0x127c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.99165

.rsrc\x00\x12

MD5 8ca9fd6dc1e9357e2fb282d9b2c59655
SHA1 c42fd3a01746ebf638dd327fea1504c0ed29561f
SHA256 9bc6c6db07bfef6320721f732ea1274e77804b9daeda8c06a6db91864a2ad15f
SHA3 e25dbcf79b5066dac5996ea3e435caf86f9f93e2793f218a4a1460e1604d70cf
VirtualSize 0x40000
VirtualAddress 0x3ea000
SizeOfRawData 0xc400
PointerToRawData 0x135000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 6.88102

.mackt\x00\xcf

MD5 f3b068659aa5ad16866a4c05437e8c9f
SHA1 d609b8d7e3110b8a4286ffc45b2d512fb927a5be
SHA256 5e52764a7e68ed0c11db4e9e92d1ccff1075bb977b7c30a8b8a3bdfbff549389
SHA3 9d36fe437da9a21a9d69a99e2b348e4fdf6d24d22545b1be7803cd2855259840
VirtualSize 0x4000
VirtualAddress 0x42a000
SizeOfRawData 0xe00
PointerToRawData 0x141400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.50859

04MAR05

MD5 92dd613972ba051b4008e0ef3dd736ef
SHA1 23319fede2783e0ae81d7f3c7b31948bd3348db6
SHA256 7c0899a7167f19e42234be994522fb7c53a5537b54045d52fd6cad8b32b04ca6
SHA3 88b57afd475e27d6d1dcd5daa74a91ac0c3fa103f5085e08a2d860582839b1b4
VirtualSize 0x3000
VirtualAddress 0x42e000
SizeOfRawData 0x2400
PointerToRawData 0x142200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 7.9777

._fuck_

MD5 f81a751c31b5180ba83615c62a05a72a
SHA1 545985968b4887168db0c8d2d330584a765732eb
SHA256 62ce69f42c2d296d259ce924d04f5ce105a18f0e2c6891fc6f473e797e9b2b9f
SHA3 4f9d9f1d209ff66163b6d7bf8dc1c22bbf425fef2adda0bc81e7ee2be4ec837c
VirtualSize 0x2000
VirtualAddress 0x431000
SizeOfRawData 0x1600
PointerToRawData 0x144600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.71546

.adata

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA3 c5d2460186f7233c927e7db2dcc703c0e500b653ca82273b7bfad8045d85a470
VirtualSize 0x1000
VirtualAddress 0x433000
SizeOfRawData 0
PointerToRawData 0x145c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

Imports

kernel32.dll GetProcAddress
GetModuleHandleA
LoadLibraryA
advapi32.dll RegQueryValueExA
comctl32.dll InitCommonControls
gdi32.dll CloseMetaFile
nlib.dll N_fitcat
opengl32.dll glClear
ray_trace.dll RT_ImportGetFacetObject
shell32.dll ShellExecuteA
user32.dll GetDlgItem
wininet.dll InternetOpenA
wsock32.dll gethostname
comdlg32.dll PrintDlgA

Delayed Imports

Version Info

TLS Callbacks

Load Configuration

Errors

[*] Warning: IMAGE_EXPORT_DIRECTORY field Characteristics is reserved and should be 0! [!] Error: Could not read the exported DLL name. [*] Warning: Section .adata has a size of 0! [*] Warning: Section .adata has a size of 0!